The vulnerability is an uncontrolled recursion in the unknown‑key skip path of the aws‑smithy‑json runtime crate used by smithy‑rs. A maliciously crafted JSON payload that contains deeply nested structures can trigger repeated recursion without termination, exhausting the stack and forcing the server to abort. The impact is a remote denial of service that can be performed without authentication, affecting any server built with smithy‑rs that uses a pre‑0.62.7 version of aws‑smithy‑json. The weakness is a classic uncontrolled recursion scenario, identified by CWE‑674.

The flaw resides in the AWS aws‑smithy‑json crate, a core component of the smithy‑rs code generator. All servers that rely on smithy‑rs generated structs and invoke aws‑smithy‑json for deserialization before version 0.62.7 are affected. The product, when used in an HTTP server context, can be abused by any remote party. No specific operating system or deployment environment is mentioned, so the vulnerability applies to all environments that include this crate.

The CVSS score of 8.7 indicates high severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is publicly known and not listed in the CISA KEV catalog, suggesting it is not yet widely exploited. The likely attack vector is remote, unauthenticated, and requires sending a single deeply nested JSON request over HTTP to a smithy‑rs generated server. If the server processes the payload, the unchecked recursion will exhaust the stack, causing an abort and disabling the service until restarted. Given the unchecked recursion, the likelihood of successful exploitation is high for affected deployments that use an unpatched version.